Apparatus and method for determining context-aware and adaptive thresholds in a communications system

ABSTRACT

A system is configured to generate an alarm when an anomaly occurs at a network infrastructure element. The system includes a transceiver configured to receive data associated with a performance indicator on a predefined basis. The system also includes a processor configured to use the received data to determine a normalized trend for the performance indicator for at least one of a given network infrastructure element and a given time period. The processor is further configured to apply a degree of deviation to the determined normalized trend for at least one of the given network infrastructure element and the given time period to generate an adaptive threshold for the performance indicator. An alarm generator generates an alarm to indicate an anomaly at the given network infrastructure element when newly received data associated with the performance indicator is beyond the adaptive threshold associated with the performance indicator.

BACKGROUND OF THE INVENTION

Narrowband and broadband communications systems are typically used bypublic safety agencies, for example, emergency first responderorganizations, such as police or fire departments, or public worksorganizations. Examples of narrowband systems include a Land MobileRadio (LMR) system or a Terrestrial Trunked Radio (TETRA) system. Anexample of a broadband system is one that operates in accordance withthe Long Term Evolution (LTE) signaling standard. Users on narrowbandand broadband systems may communicate via mobile or portable userterminals, such as portable narrowband two-way radios, mobile radios,dispatch consoles, laptops, tablets, personal digital assistants (PDA),smart phones, or other similar broadband mobile devices that communicatewith one another via wired and/or wireless networks.

Regardless of the type of communication network being used, it isimportant to determine when system anomalies occur on a networkinfrastructure. One current method for determining when a serviceanomaly occurs on a specific network infrastructure is to set astatic/predetermined threshold for each parameter that is beingevaluated and to compare that predetermined threshold againststatistical values retrieved for that parameter. If a retrievedstatistical value is beyond (for example, greater than or less than) thepredetermined threshold associated with a parameter, an alarm istypically raised to indicate a potential service anomaly. Consider anexample where a statistical value associated with a percentage ofdropped calls is reported for each sector in each cell site in acommunication system. The reported percentage from each cell site oreach sector is compared against a predetermined threshold set for thepercentage of dropped calls. If, for example, the predeterminedthreshold for the percentage of dropped calls is set at ten percent,when any cell site or sector reports a percentage of dropped callsgreater than ten percent, the system may determine that an anomaly hasoccurred at that cell site or sector and an alarm may be raised toindicate the anomaly.

The problem with this approach is it is difficult to set one system widethreshold for a given parameter because use of a network component mayvary. For example, some cell sites may be in urban areas with highdensity and other cell sites may be in rural areas with larger coverageareas. It may therefore be considered “normal” for those cell sites withlarger coverage areas to have a larger percentage of dropped calls thanthose cell sites with smaller coverage areas. Therefore, when a singlethreshold is set for the entire system, there may be a high number offalse alarms in cell sites with a normally large percentage of droppedcalls. One way to overcome generating a high number of false alarms isto set the predetermined threshold for each parameter to a valueassociated with catastrophe. In other words, the threshold may be set toa value that is high so that no alarms will be issued unless acatastrophe occurs. This approach clearly leads to a situation whereperformance degradation not rising to a catastrophic level will likelygo unnoticed.

As an alternative, a predetermined threshold value may be set for eachnetwork component being evaluated. For example, a separate predeterminedthreshold may be set of each parameter associated with each cell siteand also for given time periods, for example, a busy hour such as 9:00am-10:00 am on a weekday versus a non-busy hour such as the same periodon the weekend. Setting a separate predetermined threshold value foreach network component exponentially increases the number of thresholdsthat have to be managed. Maintaining large numbers of predeterminedthresholds is problematic because as communications systems expand withadditional infrastructure, users, and/or services, the static thresholdsare likely to become obsolete and must be updated to account for thedynamic changes in a communication system. In addition, there is noclear avenue for determining a value that is to be assigned to eachpredetermined threshold.

Accordingly, there is a need for an apparatus and method for determiningcontext aware and adaptive thresholds in a communications system.

BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWINGS

The accompanying figures, where like reference numerals refer toidentical or functionally similar elements throughout the separateviews, together with the detailed description below, are incorporated inand form part of the specification, and serve to further illustrateembodiments of concepts that include the claimed invention, and explainvarious principles and advantages of those embodiments.

FIG. 1 is a block diagram of a system used in accordance with someembodiments.

FIG. 2 is a block diagram of a management system used in accordance withsome embodiments.

FIG. 3 is a flow diagram of steps implemented in accordance with someembodiments.

FIG. 4 is a block diagram of a computing device that is configured togenerate an alarm in accordance with some embodiments.

Skilled artisans will appreciate that elements in the figures areillustrated for simplicity and clarity and have not necessarily beendrawn to scale. For example, the dimensions of some of the elements inthe figures may be exaggerated relative to other elements to help toimprove understanding of embodiments of the present invention.

The apparatus and method components have been represented whereappropriate by conventional symbols in the drawings, showing only thosespecific details that are pertinent to understanding the embodiments ofthe present invention so as not to obscure the disclosure with detailsthat will be readily apparent to those of ordinary skill in the arthaving the benefit of the description herein.

DETAILED DESCRIPTION OF THE INVENTION

Some embodiments are directed to methods and systems for generating analarm when an anomaly occurs at a network infrastructure element. Thesystem includes a transceiver configured to receive data associated witha performance indicator on a predefined basis. The system also includesa processor configured to use the received data to determine anormalized trend for the performance indicator for at least one of agiven network infrastructure element and a given time period. Theprocessor is further configured to apply a degree of deviation to thedetermined normalized trend for at least one of the given networkinfrastructure element and the given time period to calculate anadaptive threshold for the performance indicator. An alarm generatorgenerates an alarm to indicate an anomaly at the given networkinfrastructure element when newly received data associated with theperformance indicator is beyond the adaptive threshold associated withthe performance indicator.

FIG. 1 is a block diagram of a system used in accordance with someembodiments. System 100 illustrates elements of a Long Term Evolution(LTE) system, although any broadband or narrowband system may be used.System 100 includes multiple evolved Node Bs (eNBs) 102 (that is, eNBs102 a and 102 b), each of which communicates directly with a corenetwork 104 and with one or more user equipment 106 (that is, userequipment 106 a-106 d), such as mobile phones, smart phones, tablets orlaptops. Core network 104 includes a serving gateway 114 and a mobilitymanagement entity 116. Serving gateway 114 routes incoming and outgoinginternet protocol (IP) packets and anchors handover between eNBs 102.Mobility management entity 116 handles signaling related to mobility andsecurity. System 100 also includes a management system 120 whichcollects key performance indicator (KPI) data and generates adaptivethresholds for each KPI being measured in the communication systemduring a particular time frame. Although FIG. 1 shows a broadbandsystem, embodiments may be implemented in any broadband, narrowband orad hoc communications system.

Each eNB 102 provides coverage to one or more cells and manages radioresources and mobility in corresponding cell sites 118 (that is, cellsites 118 a and 118 b) to optimize communication with connected userequipment 106. For example, eNB 102 a provides coverage to one or morecells (not shown) associated with cell site 118 a and eNB 102 b providescoverage to one or more cells (not shown) associated with cell site 118b. Therefore, user equipment 106 in each cell sends information to andreceives information from core network 104 through the eNB 102 in thecell in which the user equipment operates.

In some embodiments, management system 120 is configured to monitor oneor more KPIs being measured at a specific network infrastructureelement. Non-limiting examples of KPIs that may be measured at a networkinfrastructure element (for example, serving gateway 114, mobilitymanagement entity 116, eNB 102, or one or more cells in cell sites 118)include performance indicators for a connection establishment successrate, a connection drop rate, a handover success rate, throughput, ablock error rate, a call drop rate and cell unavailability. Managementsystem 120 collects data associated with each KPI measured at a networkinfrastructure element over a predefined time period, determines anormalized trend for each KPI over the predefined time period,calculates an adaptive threshold for each KPI based on the normalizedtrend for that KPI, and generates an alarm when an incoming dataassociated a KPI goes beyond the adaptive threshold.

FIG. 2 is a block diagram of management system 120 in accordance withsome embodiments. Management system 120 includes a transceiver 202, astorage entity 204, a processor 206, and an alarm generator 208.Transceiver 202 is configured to receive, over a period of time, dataassociated with each KPI being measured at a network infrastructureelement on a predefined basis. For instance, every fifteen minutes or atthe same time every day, transceiver 202 may receive data for measuringthe throughput at one or more cells in each cell site 118. Themeasurement data may be collected for a predefined time period, forexample, every hour or daily. The collected KPI data are stored instorage entity 204 in association with the KPI.

Using the collected data associated with a particular KPI, processor 206is configured to calculate a normalized trend and associate thenormalized trend for that KPI with the particular network infrastructureelement that provided the collected data and/or time period during whichthe data was collected. The normalized trend may be calculated by, forexample, averaging previously received statistical data associated withthe KPI over a given time period. In another example, the normalizedtrend may be calculated by averaging a subset of the previously receivedstatistical data associated with the KPI over a given time period or byusing a median or mode of the previously received statistical dataassociated with the KPI over a given time period. Using the example,where transceiver 202 receives data measuring the throughput of one ormore cells in a cell site 118, processor 206 may use throughput datacollected from each of cell sites 118 a and 118 b over a predefined timeperiod, for example, one week, to calculate a normalized trend forthroughput at each of cell sites 118 a and 118 b. Processor 206 may alsocalculate normalized trends for specific time periods. For example,processor 206 may use throughput data collected at a first, specifictime period, for example from 9-10 am on weekdays, from one or morecells in cell sites 118 a and 118 b over a second, predefined period oftime, for example, over one or more weeks, to calculate a normalizedtrend for throughput at each of the one or more cells in cell sites 118a and 118 b at that specific time period (i.e., 9-10 am).

Processor 206 then calculates an adaptive threshold for each KPIassociated with a given infrastructure and/or a given time period byapplying a degree of deviation to the normalized trend associated withthat KPI. Using an example where the percentage of dropped calls is aKPI being monitored by management system 120, processor 206 may use thenormalized trend calculated for the percentage of dropped calls at oneor more cells in cell site 118 a and/or 118 b to calculate an adaptivethreshold for measuring the percentage of dropped calls at each of thecells in cell site 118 a and/or 118 b over a given period of time.Consider the example where one cell in cell site 118 a reports that onaverage three percent of the calls at that cell were dropped between9-10 am on weekdays for the past five week days and one cell in cellsite 118 b reports that on average five percent of the calls at thatsite were dropped between 9-10 am on weekdays for the past five weekdays. Using this information, processor 206 may apply a twenty fivepercent deviation to the three percent average reported by the cell incell site 118 a to calculate an adaptive threshold for the percentage ofdropped calls at the cell in cell site 118 a at 3.75 percent. Similarly,processor 206 may apply a twenty five percent deviation to the fivepercent average reported by the cell in cell site 118 b to calculate anadaptive threshold for the percentage of dropped calls at the cell incell site 118 b at 6.25 percent. Alternatively, processor 206 maycalculate a system-wide normalized trend by, for example, averaging thethree percent average for the cell in cell site 118 a and the fivepercent average for the cell in cell site 118 b to obtain an overallfour percent average. Processor 206 may apply a twenty five percentdeviation (or any other suitable deviation) to the overall four percentaverage to calculate an adaptive threshold for the percentage of droppedcalls at the two cell in cell sites 118 a and 118 b at five percent.

As transceiver 202 receives new data for the measured KPI, processor 206may calculate/update the normalized trend for the KPI. Therefore, theadaptive thresholds generated by processor 206 are subject to changewith the usage or service patterns of a particular infrastructurecomponent. Furthermore, processor 206 may be configured to continuouslyevaluate batches of statistical data associated with a measured KPI toshow deviations from the normalized trend. The deviations may becompiled in, for example, a table or shown on a geographical map tohighlight degradation at specific infrastructure components.

Alarm generator 208 may send an alarm to indicate an anomaly at anetwork infrastructure element when a newly received KPI value or set ofvalues is beyond (for example, above or below) the current adaptivethreshold associated with the measured KPI. Continuing with the examplewhere the current adaptive threshold is calculated for the percentage ofdropped calls at two cells in cell sites 118 a and 108 b, alarmgenerator 208 may send an alarm to indicate an anomaly at the cell incell site 118 a, when the cell in cell site 118 a reports that thepercentage of dropped calls for a time period being measured is abovethe computed threshold, i.e., 3.75 percent. Using this system, alarmgenerator 208 is configured to send an alarm when there is noticeabledegradation in service, even if that degradation does not rise to acatastrophic level. Management system 120 therefore eliminates falsealarms associated with outdated thresholds and eliminates the need forcontinual and manual reconfiguration of performance thresholds.

FIG. 3 is a flow diagram of steps implemented in accordance with someembodiments. At 305, management system 120 receives and stores datameasured for a KPI at a given network infrastructure element over apredefined time period. At 310, management system 120 associates thereceived KPI data with the network infrastructure element that providedthe KPI data and/or with the time period during which the KPI data wasmeasured at the network infrastructure. At 315, management system 120calculates a normalized trend for the KPI associated with the networkinfrastructure element and/or time period. At 320, management system 120applies a degree of deviation to the normalized trend to calculate athreshold for the KPI associated with a given infrastructure and/orperiod of time. At 325, management system 120 updates, that is,re-computes, the normalized trend for the KPI when a new value or a setof new values associated with the KPI is received from the associatedinfrastructure element. At 330, management system 120 sends an alarm toindicate an anomaly at the infrastructure element associated with theKPI when a newly received KPI value is above or below the currentthreshold associated with the KPI.

FIG. 4 is a block diagram of a computing device, such as managementsystem 120, that is configured to generate an alarm in accordance withsome embodiments. The computing device may be, for example, a serverconnected to a network. The computing device includes a communicationsunit 402 coupled to a common data and address bus 417 of a processingunit 403. The computing device may also include an input unit (e.g.,keypad, pointing device, mouse, etc.) 406, an output transducer unit(e.g., speaker) 420, an input transducer unit (e.g., a microphone) (MIC)421, and a display screen 405, each coupled to be in communication withthe processing unit 403.

The processing unit 403 may be configured to perform the steps describedin FIG. 3 and perform the functions of processor 206 and/or alarmgenerator 208. The processing unit 403 may also include anencoder/decoder 411 with an associated code ROM 412 for storing data forencoding and decoding voice, data, control, or other signals that may betransmitted or received by the computing device. The processing unit 403may further include a microprocessor 413 coupled, by the common data andaddress bus 417, to the encoder/decoder 411, a character ROM 414, a RAM404, and a static memory 416. The processing unit 403 may also include adigital signal processor (DSP) 419, coupled to the speaker 420, themicrophone 421, and the common data and address bus 417, for operatingon audio signals received from one or more of the communications unit402, the static memory 416, and the microphone 421.

The communications unit 402 may include an RF interface 409 configurableto communicate with network components, and other user equipment withinits communication range. The communications unit 402 may include one ormore broadband and/or narrowband transceivers 408, such as an Long TermEvolution (LTE) transceiver, a Third Generation (3G) (3GGP or 3GGP2)transceiver, an Association of Public Safety Communication Officials(APCO) Project 25 (P25) transceiver, a Digital Mobile Radio (DMR)transceiver, a Terrestrial Trunked Radio (TETRA) transceiver, a WiMAXtransceiver perhaps operating in accordance with an IEEE 802.16standard, and/or other similar type of wireless transceiver configurableto communicate via a wireless network for infrastructure communications.The communications unit 402 may include one or more local area networkor personal area network transceivers such as Wi-Fi transceiver perhapsoperating in accordance with an IEEE 802.11 standard (e.g., 802.11a,802.11b, 802.11g), or a Bluetooth transceiver, for subscriber device tosubscriber device communications. The transceivers may be coupled to acombined modulator/demodulator 410 that is coupled to theencoder/decoder 411. The character ROM 414 stores code for decoding orencoding data such as control, request, or instruction messages, channelchange messages, and/or data or voice messages that may be transmittedor received by the computing device. Static memory 416 may storeoperating code associated with operating the computing device.

In the foregoing specification, specific embodiments have beendescribed. However, one of ordinary skill in the art appreciates thatvarious modifications and changes can be made without departing from thescope of the invention as set forth in the claims below. Accordingly,the specification and figures are to be regarded in an illustrativerather than a restrictive sense, and all such modifications are intendedto be included within the scope of present teachings.

The benefits, advantages, solutions to problems, and any element(s) thatmay cause any benefit, advantage, or solution to occur or become morepronounced are not to be construed as a critical, required, or essentialfeatures or elements of any or all the claims. The invention is definedsolely by the appended claims including any amendments made during thependency of this application and all equivalents of those claims asissued.

Moreover in this document, relational terms such as first and second,top and bottom, and the like may be used solely to distinguish oneentity or action from another entity or action without necessarilyrequiring or implying any actual such relationship or order between suchentities or actions. The terms “comprises,” “comprising,” “has”,“having,” “includes”, “including,” “contains”, “containing” or any othervariation thereof, are intended to cover a non-exclusive inclusion, suchthat a process, method, article, or apparatus that comprises, has,includes, contains a list of elements does not include only thoseelements but may include other elements not expressly listed or inherentto such process, method, article, or apparatus. An element proceeded by“comprises . . . a”, “has . . . a”, “includes . . . a”, “contains . . .a” does not, without more constraints, preclude the existence ofadditional identical elements in the process, method, article, orapparatus that comprises, has, includes, contains the element. The terms“a” and “an” are defined as one or more unless explicitly statedotherwise herein. The terms “substantially”, “essentially”,“approximately”, “about” or any other version thereof, are defined asbeing close to as understood by one of ordinary skill in the art, and inone non-limiting embodiment the term is defined to be within 10%, inanother embodiment within 5%, in another embodiment within 1% and inanother embodiment within 0.5%. The term “coupled” as used herein isdefined as connected, although not necessarily directly and notnecessarily mechanically. A device or structure that is “configured” ina certain way is configured in at least that way, but may also beconfigured in ways that are not listed.

It will be appreciated that some embodiments may be comprised of one ormore generic or specialized processors (or “processing devices”) such asmicroprocessors, digital signal processors, customized processors andfield programmable gate arrays (FPGAs) and unique stored programinstructions (including both software and firmware) that control the oneor more processors to implement, in conjunction with certainnon-processor circuits, some, most, or all of the functions of themethod and/or apparatus described herein. Alternatively, some or allfunctions could be implemented by a state machine that has no storedprogram instructions, or in one or more application specific integratedcircuits (ASICs), in which each function or some combinations of certainof the functions are implemented as custom logic. Of course, acombination of the two approaches could be used.

Moreover, an embodiment can be implemented as a computer-readablestorage medium having computer readable code stored thereon forprogramming a computer (e.g., comprising a processor) to perform amethod as described and claimed herein. Examples of suchcomputer-readable storage mediums include, but are not limited to, ahard disk, a CD-ROM, an optical storage device, a magnetic storagedevice, a ROM (Read Only Memory), a PROM (Programmable Read OnlyMemory), an EPROM (Erasable Programmable Read Only Memory), an EEPROM(Electrically Erasable Programmable Read Only Memory) and a Flashmemory. Further, it is expected that one of ordinary skill,notwithstanding possibly significant effort and many design choicesmotivated by, for example, available time, current technology, andeconomic considerations, when guided by the concepts and principlesdisclosed herein will be readily capable of generating such softwareinstructions and programs and ICs with minimal experimentation.

The Abstract of the Disclosure is provided to allow the reader toquickly ascertain the nature of the technical disclosure. It issubmitted with the understanding that it will not be used to interpretor limit the scope or meaning of the claims. In addition, in theforegoing Detailed Description, it can be seen that various features aregrouped together in various embodiments for the purpose of streamliningthe disclosure. This method of disclosure is not to be interpreted asreflecting an intention that the claimed embodiments require morefeatures than are expressly recited in each claim. Rather, as thefollowing claims reflect, inventive subject matter lies in less than allfeatures of a single disclosed embodiment. Thus the following claims arehereby incorporated into the Detailed Description, with each claimstanding on its own as a separately claimed subject matter.

We claim:
 1. A management system comprising: a transceiver configured toreceive data associated with a performance indicator on a predefinedbasis; a processor configured to use the received data to determine anormalized trend for the performance indicator for at least one of agiven network infrastructure element and a given time period andconfigured to apply a degree of deviation to the determined normalizedtrend for at least one of the given network infrastructure element andthe given time period to generate an adaptive threshold for theperformance indicator; and an alarm generator configured to generate analarm to indicate an anomaly at the given network component when newlyreceived data associated with the performance indicator is beyond theadaptive threshold associated with the performance indicator.
 2. Themanagement system of claim 1, wherein the processor is configured tocalculate the normalized trend associated with the performance indicatorreceived over a predefined time period.
 3. The management system ofclaim 1, wherein the processor is configured to update the normalizedtrend for the performance indicator subsequent to receiving new dataassociated with the performance indicator.
 4. The management system ofclaim 1, wherein the processor is configured to associate the receiveddata associated with the performance indicator with a networkinfrastructure element that sent the data.
 5. The management system ofclaim 1, wherein the processor is configured to associate the receiveddata associated with the performance indicator with a time period duringwhich the data was measured at a network infrastructure element.
 6. Themanagement system of claim 1, further comprising a storage entityconfigured to store the received data in association with theperformance indicator.
 7. The management system of claim 1, wherein theprocessor is configured to calculate the normalized trend for theperformance indicator based on information received from one or morenetwork infrastructure elements and is configured to generate theadaptive threshold for the performance indicator being measured at theone or more network infrastructure elements.
 8. The management system ofclaim 1, wherein the processor is further configured to evaluatestatistical data associated with the performance indicator to showdeviations from the normalized trend.
 9. A method comprising: receiving,by a management system, data associated with a performance indicator ona predefined basis; using the received data, by the management system,to determine a normalized trend for the performance indicator for atleast one of a given network infrastructure element and a given timeperiod; applying, by the management system, a degree of deviation to thenormalized trend; calculating, by the management system, a thresholdthat is associated with the performance indicator based the degree ofdeviation applied to the normalized trend; and receiving new dataassociated with the performance indicator and subsequent to receivingthe new data associated with the performance indicator, generating, bythe management system, an alarm to indicate an anomaly at the givennetwork infrastructure element when the new data is beyond the thresholdassociated with the performance indicator.
 10. The method of claim 9,wherein the determining the normalized trend comprises calculating thenormalized trend by averaging the received data associated with theperformance indicator over a predefined time period.
 11. The method ofclaim 9, wherein determining the normalized trend comprises updating thenormalized trend for the performance indicator subsequent to receivingnew data associated with the performance indicator.
 12. The method ofclaim 9, further comprising associating the received data associatedwith the performance indicator with a network infrastructure elementthat sent the data.
 13. The method of claim 9, further comprisingassociating the received data associated with the performance indicatorwith a time period during which the data was measured at a networkinfrastructure element.